• Please be aware: Kaspersky Anti-Virus has been deprecated
    With the upgrade to Plesk Obsidian 18.0.64, "Kaspersky Anti-Virus for Servers" will be automatically removed from the servers it is installed on. We recommend that you migrate to Sophos Anti-Virus for Servers.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

A lot of "Firewall: *UDP_OUT Blocked*" on ports 67 and 68

L

Lord Senil

Guest
Hello, some time ago I installed an application on my CentOS 5.3 call csf / lfd I have solved a lot of problems. The only detail worth noting is that now when I do a dmesg gives me a huge list on the firewall:

[149688.784131] Firewall: *UDP_OUT Blocked* IN= OUT=eth0 SRC=87.106.177.*** DST=87.106.137.250 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=68 DPT=67 LEN=308
[149703.783775] Firewall: *UDP_OUT Blocked* IN= OUT=eth0 SRC=87.106.177.*** DST=87.106.137.250 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=68 DPT=67 LEN=308
[149720.783555] Firewall: *UDP_OUT Blocked* IN= OUT=eth0 SRC=87.106.177.*** DST=87.106.137.250 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=68 DPT=67 LEN=308
[149739.783188] Firewall: *UDP_OUT Blocked* IN= OUT=eth0 SRC=87.106.177.*** DST=87.106.137.250 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=68 DPT=67 LEN=308

Note: asterisk put for me, is my IP :p

So I guess, seems to be a DHCP traffic. Not if it is correct or is this traffic that I have to configure the firewall to let it go I do not congested traffic and the server.
I have a Plesk 9.2.3 server with CentOS 5.3 and csf / lfd

Thanks in advance. ^^
 
Firewall for Plesk server should be configured according following list of ports that should be opened for correct Plesk operation: http://kb.odin.com/en/391
As you can see there are no mentions about ports 67 and 68. Therefore I'm not sure that it is Plesk related traffic.
 
Thanks, I found that the cause of this traffic is the dhclient program, I've uninstalled and I killed the process that was underway. Now there is nothing unusual.
But there was a problem much bigger, and that is that novice that I am, I realized that this daemon is necessary to lift the network server to reboot!
Dhclient desinstaleis not for anything!

Greetings and thanks for the quick reply.
 
Last edited by a moderator:
Back
Top